jre17-zulu-bin

LOW

maintainer puddings233 1 votes scanned 2026-11-01 00:21:48.120785

View on AUR

Why flagged

The package downloads prebuilt JRE binaries from Azul's official CDN (cdn.azul.com), which is the legitimate source for Zulu OpenJDK; despite the static analyzer flag for a non-standard host, this is a normal and expected source for this software, and the downloads are verified via sha256sums.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads prebuilt JRE binaries from Azul's official CDN (cdn.azul.com), which is the legitimate source for Zulu OpenJDK; despite the static analyzer flag for a non-standard host, this is a normal and expected source for this software, and the downloads are verified via sha256sums.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:44 "https://cdn.azul.com/zulu/bin/zulu${_majorver}.${_zulu_build}-ca-jre${_majorver}.${_minorver}.${_securityver}-linux_aarch64.tar.gz"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: puddings233 <puddings233 at outlook dot com>
    
      2
    
      3_majorver=17
    
      4_minorver=0
    
      5_securityver=21
    
      6_updatever=9
    
      7_zulu_build="70.111"
    
      8pkgname=jre${_majorver}-zulu-bin
    
      9pkgver=${_majorver}.${_minorver}.${_securityver}+${_updatever}
    
      10pkgrel=1
    
      11pkgdesc='Azul Zulu OpenJDK full runtime environment, bin version.'
    
      12arch=('aarch64' 'i686' 'x86_64')
    
      13url='https://www.azul.com/downloads/'
    
      14license=('custom')
    
      15depends=(
    
      16  "java-runtime-common>=3"
    
      17  "ca-certificates-utils"
    
      18  "freetype2"
    
      19  "glibc"
    
      20  "harfbuzz"
    
      21  "lcms2"
    
      22  "libgcc"
    
      23  "libjpeg-turbo"
    
      24  "libnet"
    
      25  "libstdc++"
    
      26  "nss"
    
      27  "giflib"
    
      28  "libpng"
    
      29)
    
      30optdepends=(
    
      31  'alsa-lib: for basic sound support'
    
      32  'gtk3: for the Gtk+ 3 look and feel - desktop usage'
    
      33)
    
      34provides=(
    
      35  "java-runtime=${_majorver}"
    
      36  "java-runtime-openjdk=${_majorver}"
    
      37  "jre${_majorver}-openjdk=${pkgver}-${pkgrel}"
    
      38  "java-runtime-headless=${_majorver}"
    
      39  "java-runtime-headless-openjdk=${_majorver}"
    
      40  "jre${_majorver}-openjdk-headless=${pkgver}-${pkgrel}"
    
      41)
    
      42install="$pkgname.install"
    
      43source_aarch64=(
    
      44  "https://cdn.azul.com/zulu/bin/zulu${_majorver}.${_zulu_build}-ca-jre${_majorver}.${_minorver}.${_securityver}-linux_aarch64.tar.gz"
    
      45  "freedesktop-java.desktop"
    
      46)
    
      47source_i686=(
    
      48  "https://cdn.azul.com/zulu/bin/zulu${_majorver}.${_zulu_build}-ca-jre${_majorver}.${_minorver}.${_securityver}-linux_i686.tar.gz"
    
      49  "freedesktop-java.desktop"
    
      50)
    
      51source_x86_64=(
    
      52  "https://cdn.azul.com/zulu/bin/zulu${_majorver}.${_zulu_build}-ca-jre${_majorver}.${_minorver}.${_securityver}-linux_x64.tar.gz"
    
      53  "freedesktop-java.desktop"
    
      54)
    
      55sha256sums_aarch64=(
    
      56  '6ef6ddc863022083d1d33509eff2d5fb580d000cebfdcf5602a6a3c6239d1557'
    
      57  '4b0278be06c9705063305da113c9b9e6ddf3c00d3a3c51e894885e08ba42dbcb'
    
      58)
    
      59sha256sums_i686=(
    
      60  'f971684957a57f30a162d71732bfaa5bcc097a873d220abaa9aeea1b0793c7e9'
    
      61  '4b0278be06c9705063305da113c9b9e6ddf3c00d3a3c51e894885e08ba42dbcb'
    
      62)
    
      63sha256sums_x86_64=(
    
      64  '95f5ca5ad770f631f94738f328e6da8f085452443aae54f95b8a45be9f6c2d9d'
    
      65  '4b0278be06c9705063305da113c9b9e6ddf3c00d3a3c51e894885e08ba42dbcb'
    
      66)
    
      67
    
      68_jvmdir=/usr/lib/jvm/java-${_majorver}-zulu
    
      69
    
      70case "${CARCH}" in
    
      71  aarch64) _JARCH='aarch64';;
    
      72  i686)   _JARCH='i686';;
    
      73  x86_64) _JARCH='x64';;
    
      74esac
    
      75
    
      76package() {
    
      77
    
      78  cd "$srcdir/zulu${_majorver}.${_zulu_build}-ca-jre${_majorver}.${_minorver}.${_securityver}-linux_${_JARCH}"
    
      79
    
      80  install -dm 755 "${pkgdir}${_jvmdir}"
    
      81
    
      82  cp -a bin lib \
    
      83    "${pkgdir}${_jvmdir}"
    
      84
    
      85  # Conf
    
      86  install -dm 755 "${pkgdir}/etc"
    
      87  cp -r conf "${pkgdir}/etc/java${_majorver}-zulu"
    
      88  ln -s "/etc/java${_majorver}-zulu" "${pkgdir}/${_jvmdir}/conf"
    
      89
    
      90  # Legal
    
      91  install -dm 755 "${pkgdir}/usr/share/licenses"
    
      92  cp -r legal "${pkgdir}/usr/share/licenses/java${_majorver}-zulu"
    
      93  cp DISCLAIMER "${pkgdir}/usr/share/licenses/java${_majorver}-zulu/"
    
      94  ln -s "/usr/share/licenses/java${_majorver}-zulu" "${pkgdir}/${_jvmdir}/legal"
    
      95
    
      96  # Link JKS keystore from ca-certificates-utils
    
      97  rm -f "${pkgdir}${_jvmdir}/lib/security/cacerts"
    
      98  ln -sf /etc/ssl/certs/java/cacerts "${pkgdir}${_jvmdir}/lib/security/cacerts"
    
      99
    
      100  # Desktop files
    
      101  install -Dm 644 \
    
      102    "${srcdir}/freedesktop-java.desktop" \
    
      103    "${pkgdir}/usr/share/applications/java-java${_majorver}-zulu.desktop"
    
      104}
    
      105
    
      106# vim: ts=2 sw=2 et:
    
      107

Changes since previous scan

--- PKGBUILD @ 2026-10-25 00:20
+++ PKGBUILD @ 2026-11-01 00:21
@@ -2,12 +2,12 @@
 
 _majorver=17
 _minorver=0
-_securityver=20.1
-_updatever=1
-_zulu_build="68.203"
+_securityver=21
+_updatever=9
+_zulu_build="70.111"
 pkgname=jre${_majorver}-zulu-bin
 pkgver=${_majorver}.${_minorver}.${_securityver}+${_updatever}
-pkgrel=2
+pkgrel=1
 pkgdesc='Azul Zulu OpenJDK full runtime environment, bin version.'
 arch=('aarch64' 'i686' 'x86_64')
 url='https://www.azul.com/downloads/'
@@ -53,15 +53,15 @@
   "freedesktop-java.desktop"
 )
 sha256sums_aarch64=(
-  '12e8a6a0957c38bcb16b0d18187ba60dfe88e9d16dd99e5eefd5929d1b132931'
+  '6ef6ddc863022083d1d33509eff2d5fb580d000cebfdcf5602a6a3c6239d1557'
   '4b0278be06c9705063305da113c9b9e6ddf3c00d3a3c51e894885e08ba42dbcb'
 )
 sha256sums_i686=(
-  'acda3a3a691df809f7b14b002b7a0db89f9a5733a537ac303fc88568ccb5a4ed'
+  'f971684957a57f30a162d71732bfaa5bcc097a873d220abaa9aeea1b0793c7e9'
   '4b0278be06c9705063305da113c9b9e6ddf3c00d3a3c51e894885e08ba42dbcb'
 )
 sha256sums_x86_64=(
-  'ab4f4e4bee5db1a266ba08134cd93275ca394c025afde58e6cd34f6aee8d6eb9'
+  '95f5ca5ad770f631f94738f328e6da8f085452443aae54f95b8a45be9f6c2d9d'
   '4b0278be06c9705063305da113c9b9e6ddf3c00d3a3c51e894885e08ba42dbcb'
 )
 

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-01 00:21:48	Low	2
2026-10-31 00:07:41	Low	2
2026-10-30 00:29:30	Low	2
2026-10-29 00:13:55	Low	2
2026-10-28 00:06:54	Low	2
2026-10-27 00:23:28	Low	2
2026-10-26 00:12:40	Low	2
2026-10-25 07:42:02	Medium	1
2026-10-25 00:20:48	Low	2
2026-10-24 00:14:55	Low	2
2026-10-23 00:02:19	Low	2
2026-10-22 00:13:10	Low	2
2026-10-21 00:12:50	Low	2
2026-10-20 00:10:31	Low	2
2026-10-19 00:03:55	Low	2
2026-10-18 00:06:55	Low	2
2026-10-17 00:21:55	Low	2
2026-10-16 00:12:47	Low	2
2026-10-15 00:28:05	Low	2
2026-10-14 00:06:47	Low	2